Skip to main content

Cross Account Read Access

To let a CAIP Workflow read data in an external AWS account grant its execution role permission to assume a role in that account. This uses short lived role chaining, no static AWS keys.

Note:

You need administrative access to the external AWS account and a spaceId on CAIP with permission to raise OMS orders. Repeat the OMS order for each stage you want to enable.

The setup has two sides:

  1. CAIP side. Raise an OMS order attaching an sts:AssumeRole policy to the workflow execution role.
  2. External account side. Deploy a CloudFormation template creating the role to assume with read only access to the resources to share.

1. Create the CAIP policy through OMS​

In OMS (prod) open Orders (/v1/spaces/{spaceId}/orders) and create a Create custom IAM permission order:

You can assign multiple stages to the same order (i.e. int, test, prod), to apply the same permission to multiple stages within your usecase.

{
  "scope": "iam-permission:create",
  "payload": {
    "name": "Assume external read-only role",
    "policyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AssumeExternalReadOnlyRole",
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/<EXTERNAL_ROLE_NAME>"
        }
      ]
    },
    "stages": ["<stage>"],
    "roleTypes": ["service"]
  }
}

Replace <EXTERNAL_ACCOUNT_ID>, <EXTERNAL_ROLE_NAME>, and <stage> (test/int/e2e/prod, the stage your workflow version is assigned to).

2. Create the role to be assumed (external account)​

Once the OMS order is fulfilled generate a CloudFormation template for the external account:

Loading template generator…

Fill in the role name, your spaceId, and the external account ID. The CAIP role ARN is derived from the spaceId. Pick the read access types (S3, Glue, or CDH dataset). The template creates only the assumable role — it does not touch existing buckets, databases, or KMS keys.

Deploy the template in the external account​

  1. CloudFormation → Create stack → With new resources (standard).
  2. Upload a template file → choose the generated YAML → Next.
  3. Stack name (e.g. CDHConnectionAccessRole); set Region to eu-central-1 if prompted → Next.
  4. Acknowledge AWS CloudFormation might create IAM resources → Submit.
  5. Wait for CREATE_COMPLETE on the Stacks page. If it fails, check the Events tab for the reason.

For CDH resource permissions see the CDH resource permissions guide.